ROLLING 14-DAY INTELLIGENCE • SEPTEMBER 21–OCTOBER 4, 2026

AI Crisis Tracker

Current intelligence on AI, agentic and physical crises, including what happened, what is confirmed, where it may spread and what leaders may wish to consider next.

CERTIFIED REVIEW

OCT 4, 2026 · 8:00 AM PT78 reputable sources reviewedRolling window: previous 14 calendar dates

NEXT REPORT

MON OCT 5 · 8:00 AM PT

Updated every day at 8:00 AM Pacific, with material breaking updates added as verified

This dashboard is powered by ChatGPT. AI crisis must appear in two valid news sources to be included. AI can make mistakes. Please verify before taking action.

THREE CONFIRMED AI CRISES IN THE CURRENT WINDOW

Fourteen additional developments remain emerging signals. Today’s review updates the frontier-AI governance signal following creation of a federal task force and renewed scrutiny of voluntary safeguards. Two signals were removed under the nine-day active-mention rule.

CONFIRMED CRISES02AI systems contributed to confirmed incidents

EMERGING SIGNALS15Verified disruption, targeting or behavior under assessment

CREDIBLE REPORTS70Direct links shown with each signal

REPUTABLE SOURCES78Across nine intelligence groups

THE THREE CRISIS DOMAINS

Three dimensions of AI crisis intelligence.

A domain appears in the current ledger only when a development meets the evidence threshold.

AI crisis

Deepfakes, model failures, misinformation, discrimination, unsafe advice or other AI-enabled developments that can affect people, institutions or trust.

WATCH: authenticity · information integrity · model behavior

02 · ACTIVE IN THIS WINDOW

Agentic crisis

AI systems take consequential actions, exploit weak controls or operate beyond intended authority with limited human intervention.

WATCH: autonomy · permissions · reversibility · human override

03 · ACTIVE IN THIS WINDOW

Physical crisis

Verified disruption involving medical devices, healthcare supply chains, vehicles, robots, industrial systems or critical infrastructure where physical safety or essential operations may be affected. An AI connection is not required for an emerging signal.

WATCH: safety systems · essential operations · supply disruption · recovery

GLOBAL SITUATIONAL VIEW

Where current events are happening

Markers with a count contain multiple incidents at one verified location. Select the marker to see every issue there. Signals without a verified event or organization-headquarters location remain in the ledger.

Emerging location9 locations · 11 incidents

EMERGING · CRITICAL · PHYSICAL CRISIS

INCIDENT OCCURRED SEP 24; MATERIALLY UPDATED SEP 30–OCT 1, 2026 · ONLINE EXCHANGE WITH GLOBAL USERS; HEADQUARTERS CITY AND ATTACK ORIGIN UNCONFIRMED

Bitget loses $387.5 million after third-party zero-day breach

Bitget confirmed that attackers stole approximately $387.5 million from hot and warm wallets after exploiting a zero-day flaw in third-party security products and moving laterally into the exchange’s wallet environment. The company temporarily suspended withdrawals, says customer balances remain intact and is covering the loss through its protection fund. Bitget has pointed to methods consistent with North Korean actors, but official attribution has not been established.

Financial-infrastructure breach · zero-day exploitation · asset theftFinance · Cryptocurrency exchange · Third-party security supply chainHigh confidence

LOCATION PRECISION

Location unconfirmed: the exchange serves users globally, its headquarters city is not consistently verified in authoritative sources and the attack origin remains unknown. No marker is shown.

POTENTIAL SPREAD

The incident is the largest reported cryptocurrency theft of 2026 and demonstrates how a third-party security-product flaw can bypass controls at a major exchange serving more than 120 million users. Customer losses have not been reported, but investigation, recovery and attribution remain incomplete.

EVIDENCEReuters · Sep 25 ↗BleepingComputer · Sep 30 ↗Bitget · current ↗

FOR LEADERS · ACT

Lead with transparency, protect affected people and apply a strong ethical and moral compass. Distinguish confirmed facts from uncertainty and communicate what is known, unknown and being done next.

State the confirmed asset amount, affected wallet tiers and withdrawal status, while separating platform losses from customer balances. Name the third-party product only when disclosure is coordinated and evidence is sufficient, publish restoration criteria and avoid presenting suspected North Korean involvement as established attribution.

READ THE REPORTINGReuters · Sep 25Bitget pauses withdrawals after $351.6 million theft↗BleepingComputer · Sep 30Bitget confirms third-party zero-day behind $387.5 million theft↗Bitget · currentOfficial Bitget security-incident update↗

Corroborated across 3 credible reports

CURRENT 14-DAY INTELLIGENCE

Signal ledger

CRISIS COMMUNICATIONS BRIEF

Considerations for leaders

Best-practice considerations and possible next steps for decisions, stakeholder readiness and response in an AI-shaped crisis environment.

01 · WHAT CHANGED

High-stakes AI use requires visible provenance and independent verification.

The Gemini and military-intelligence incidents show how failures in access controls, source verification and human review can move AI output into real systems and operational decisions. Leaders should disclose where AI entered the process, preserve the evidence trail and explain which independent checks failed or succeeded.

02 · WATCH NEXT

Signals to consider include replication and named impact.

Withdrawal restoration; identification and patching of the third-party zero-day; recovery or freezing of stolen assets; regulator and law-enforcement findings; confirmed attribution; protection-fund use; evidence of other organizations affected by the same product.

03 · POSSIBLE NEXT STEPS

Prepare before attribution is complete.

Consider naming an executive decision-maker for AI and critical-system incidents.
Review agent permissions, vendors, essential operations and shutdown authority.
Consider pre-drafting holding statements for AI, agentic and physical incidents.
Establish evidence thresholds for confirming scope and cause.

HOW WE DEFINE A CRISIS SIGNAL

Four dimensions separate crisis from noise.

Confirmed AI crises require credible evidence of severe harm, systemic exposure or meaningful loss of human control. Emerging signals may also include verified disruption at a large, reputable organization in healthcare, infrastructure or another critical sector when essential or global operations are affected, even before AI involvement or downstream harm is confirmed. Natural disasters, including severe flooding, qualify only when credible reporting establishes AI involvement or disruption to AI systems. General factory, transport or supply-chain disruption alone does not qualify.

Rapid escalation

Harm can propagate faster than people can intervene.

Systemic vulnerability

Failure can affect critical sectors, institutions or populations.

Governance gaps

Deployment outpaces effective rules, oversight and accountability.

Explainability problem

Decision-makers cannot adequately audit the system under pressure.

EDITORIAL STANDARD

We scan the global news every day at 8am Pacific to provide you with updated, consolidated reports that cover AI crises from the last two weeks.

We monitor 78 reputable sources, distinguish confirmed crises from emerging signals, explain what is known and unknown, and translate the developments into practical implications for leaders.

01SCAN
Monitor 78 sources across nine complementary intelligence groups.
02CORROBORATE
Require two credible pieces of coverage, including authoritative primary evidence when available.
03CLASSIFY
Separate confirmed crises from emerging signals and routine AI product news.
04TRANSLATE
Prioritize impact on people, institutions, digital safety and trust.

Government & law enforcement: 17

FTC · FBI IC3 · CISA · U.S. Secret Service · IRS · SSA OIG · FCC · FinCEN · DOJ Elder Justice · CFPB · Europol · INTERPOL · UK NCSC · Action Fraud · ACCC · Canadian Anti-Fraud Centre · Singapore Police Force

Cybersecurity firms: 9

Microsoft Digital Crimes Unit · Google · Kaspersky · Trend Micro · Proofpoint · Palo Alto Networks · CrowdStrike · ESET · Recorded Future

Financial & payments: 9

Visa · Mastercard · PayPal · Zelle / Early Warning Services · Federal Reserve · UK FCA · FINRA · NASAA · Chainalysis

Consumer protection: 4

Better Business Bureau · AARP · Consumer Reports · Which?

Elder & family protection: 3

National Adult Protective Services Association · National Council on Aging · National Center for Missing & Exploited Children

Cyber & technology journalism: 13

BBC · CNBC · CNN · NPR · Reuters · Associated Press · Krebs on Security · BleepingComputer · The Record · WIRED · The Verge · Dark Reading · MIT Technology Review

Anti-scam reporting: 6

Scamwatch · Fraud.org · Stop Scams UK · Truecaller · Hiya · Identity Theft Resource Center

AI safety & risk research: 8

OpenAI · Google DeepMind · Anthropic · Stanford Internet Observatory · Center for Countering Digital Hate · Partnership on AI · NIST · DFRLab

Major technology newsrooms: 9

Google / The Keyword · Microsoft / On the Issues · Meta Newsroom · Apple Newsroom · About Amazon · TikTok Newsroom · X Safety · Google Safety Center · Meta Transparency Center

Coverage window: September 18–October 1, 2026. The dashboard shows only developments substantiated within the latest 14 calendar dates. An incident is removed after nine consecutive calendar days without substantive credible reporting or a material authoritative update. Sources and topics with no current development are omitted entirely. Community channels are pattern indicators, not confirmed truth; cybersecurity-company material is translated from technical intelligence; journalism supplies context but does not stand alone when stronger primary evidence is available. CFPB material is included but weighted as lower-confidence in 2026.

Recommendations are provided for educational purposes only. Any actions taken should be reviewed and cleared by the organization’s corporate legal team.